Techniques › T1204.002 › AN0819
AN0819 Analytic 0819
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.</p>
- Detects
- T1204.002 Malicious File
- Part of
- DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Seconds/minutes to correlate file write to child spawn (e.g., 0–5m). |
SuspiciousExtensions | Extensions and double-extension patterns to flag (exe,scr,lnk,pif,cpl,js,vbs,bat,cmd,ps1,hta,iso,lnk->cmd,docm,xlsm,pdf->exe, etc.). |
UserPaths | Paths considered user-controlled (Downloads, Temp, Desktop, profile AppData staging). |
ParentApps | List of user-facing apps that commonly open attachments for your org (reduce FPs or add weight). |
SignerAllowList | Trusted code signers/publishers to suppress benign admin tools. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2007-5659 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-0655 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-2992 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-1862 | Adobe Acrobat and Reader, Flash Player | Mapped |
| CVE-2009-3953 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-4324 | Adobe Acrobat and Reader | Mapped |
| CVE-2010-1297 | Adobe Flash Player | Mapped |
| CVE-2010-2883 | Adobe Acrobat and Reader | Mapped |
| CVE-2011-0611 | Adobe Flash Player | Mapped |
| CVE-2011-2462 | Adobe Reader and Acrobat | Mapped |
| CVE-2012-0754 | Adobe Flash Player | Mapped |
| CVE-2012-1535 | Adobe Flash Player | Mapped |
| CVE-2013-0641 | Adobe Reader | Mapped |
| CVE-2014-0496 | Adobe Reader and Acrobat | Mapped |
| CVE-2015-3043 | Adobe Flash Player | Mapped |
| CVE-2015-3113 | Adobe Flash Player | Mapped |
| CVE-2015-7645 | Adobe Flash Player | Mapped |
| CVE-2016-0984 | Adobe Flash Player and AIR | Mapped |
| CVE-2016-4117 | Adobe Flash Player | Mapped |
| CVE-2017-11292 | Adobe Flash Player | Mapped |
| CVE-2018-15982 | Adobe Flash Player | Mapped |
| CVE-2018-4878 | Adobe Flash Player | Mapped |
| CVE-2018-4990 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-21017 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-28550 | Adobe Acrobat and Reader | Mapped |
| CVE-2022-30190 | Microsoft Windows | Mapped |
| CVE-2022-34713 | Microsoft Windows | Mapped |
| CVE-2023-21608 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-21715 | Microsoft Office | Mapped |
| CVE-2023-26369 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-36884 | Microsoft Windows | Stale |
| CVE-2024-38080 | Microsoft Windows | Mapped |
| CVE-2025-27363 | FreeType FreeType | Mapped |